File name:

DDU v18.0.6.0.exe

Full analysis: https://app.any.run/tasks/19537be8-65cf-4caa-8c8f-c5f011a21f1d
Verdict: Malicious activity
Analysis date: July 17, 2024, 14:06:15
OS: Windows 10 Professional (build: 19045, 64 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

CA77F18F16C27A2CCACB2D62A4AB03C8

SHA1:

9EF1FBA66E055C1B370FA6FD8ED867E418FBB0A7

SHA256:

48EBDAF2E7A2EDE56E91E0800F8A1128F0E8883E4D9FEB3D46808D8218DFE8FC

SSDEEP:

49152:A/1SwKVUy/r6dlbVIAZiguBS89VmgC/K4jhOA4REqieeORvnSY/6srdkA8WjA9Sj:A/8wNdlbHZtuo8r50sA4REqieBvSSdFT

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • DDU v18.0.6.0.exe (PID: 6380)
      • DDU v18.0.6.0.exe (PID: 6688)

    • Creates a writable file in the system directory

      • Display Driver Uninstaller.exe (PID: 5876)

  • SUSPICIOUS

    • Drops 7-zip archiver for unpacking

      • DDU v18.0.6.0.exe (PID: 6380)

    • Executable content was dropped or overwritten

      • DDU v18.0.6.0.exe (PID: 6380)
      • DDU v18.0.6.0.exe (PID: 6688)

    • Executes as Windows Service

      • VSSVC.exe (PID: 3668)

    • Searches for installed software

      • dllhost.exe (PID: 5636)
      • Display Driver Uninstaller.exe (PID: 5876)

    • Reads security settings of Internet Explorer

      • Display Driver Uninstaller.exe (PID: 5876)

    • The process executes via Task Scheduler

      • PLUGScheduler.exe (PID: 3640)

    • The system shut down or reboot

      • Display Driver Uninstaller.exe (PID: 6300)

    • Application launched itself

      • Display Driver Uninstaller.exe (PID: 5876)

    • Creates files in the driver directory

      • Display Driver Uninstaller.exe (PID: 5876)

  • INFO

    • Reads the computer name

      • DDU v18.0.6.0.exe (PID: 6380)
      • DDU v18.0.6.0.exe (PID: 6688)
      • Display Driver Uninstaller.exe (PID: 5876)
      • PLUGScheduler.exe (PID: 3640)
      • Display Driver Uninstaller.exe (PID: 6300)

    • Checks supported languages

      • DDU v18.0.6.0.exe (PID: 6380)
      • DDU v18.0.6.0.exe (PID: 6688)
      • Display Driver Uninstaller.exe (PID: 5876)
      • Display Driver Uninstaller.exe (PID: 6300)
      • PLUGScheduler.exe (PID: 3640)

    • Reads security settings of Internet Explorer

      • notepad.exe (PID: 6300)

    • Create files in a temporary directory

      • DDU v18.0.6.0.exe (PID: 6380)
      • DDU v18.0.6.0.exe (PID: 6688)
      • Display Driver Uninstaller.exe (PID: 5876)

    • Manual execution by a user

      • notepad.exe (PID: 6300)
      • DDU v18.0.6.0.exe (PID: 6688)
      • Display Driver Uninstaller.exe (PID: 4400)
      • Display Driver Uninstaller.exe (PID: 5876)

    • Reads the machine GUID from the registry

      • Display Driver Uninstaller.exe (PID: 5876)
      • Display Driver Uninstaller.exe (PID: 6300)

    • Reads Environment values

      • Display Driver Uninstaller.exe (PID: 5876)

    • Reads the software policy settings

      • Display Driver Uninstaller.exe (PID: 5876)

    • Disables trace logs

      • Display Driver Uninstaller.exe (PID: 5876)

    • Checks proxy server information

      • Display Driver Uninstaller.exe (PID: 5876)

    • Creates files in the program directory

      • PLUGScheduler.exe (PID: 3640)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (64.6)
.dll | Win32 Dynamic Link Library (generic) (15.4)
.exe | Win32 Executable (generic) (10.5)
.exe | Generic Win/DOS Executable (4.6)
.exe | DOS Executable Generic (4.6)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2019:02:21 16:00:00+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, Large address aware, 32-bit
PEType: PE32
LinkerVersion: 6
CodeSize: 168960
InitializedDataSize: 53248
UninitializedDataSize: -
EntryPoint: 0x277c6
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 19.0.0.0
ProductVersionNumber: 19.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Windows NT 32-bit
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
CompanyName: Igor Pavlov
FileDescription: 7z SFX
FileVersion: 19
InternalName: 7z.sfx
LegalCopyright: Copyright (c) 1999-2018 Igor Pavlov
OriginalFileName: 7z.sfx.exe
ProductName: 7-Zip
ProductVersion: 19
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
252
Monitored processes
12
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start ddu v18.0.6.0.exe rundll32.exe no specs notepad.exe no specs ddu v18.0.6.0.exe display driver uninstaller.exe no specs display driver uninstaller.exe vssvc.exe no specs SPPSurrogate no specs display driver uninstaller.exe no specs shutdown.exe no specs conhost.exe no specs plugscheduler.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1736C:\WINDOWS\System32\rundll32.exe C:\WINDOWS\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -EmbeddingC:\Windows\System32\rundll32.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shcore.dll
c:\windows\system32\imagehlp.dll
3640"C:\Program Files\RUXIM\PLUGscheduler.exe"C:\Program Files\RUXIM\PLUGScheduler.exe—svchost.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Update LifeCycle Component Scheduler
Exit code:
0
Version:
10.0.19041.3623 (WinBuild.160101.0800)
Modules
Images
c:\program files\ruxim\plugscheduler.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\advapi32.dll
3668C:\WINDOWS\system32\vssvc.exeC:\Windows\System32\VSSVC.exe—services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft® Volume Shadow Copy Service
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\vssvc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
3884"C:\WINDOWS\system32\shutdown" /r /t 0C:\Windows\System32\shutdown.exe—Display Driver Uninstaller.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Shutdown and Annotation Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\shutdown.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
4400"C:\Users\admin\AppData\Local\Temp\DDU v18.0.6.0\Display Driver Uninstaller.exe" C:\Users\admin\AppData\Local\Temp\DDU v18.0.6.0\Display Driver Uninstaller.exe—explorer.exe
User:
admin
Company:
Wagnardsoft
Integrity Level:
MEDIUM
Description:
Display_Driver_Uninstaller
Exit code:
3221226540
Version:
18.0.6.0
Modules
Images
c:\users\admin\appdata\local\temp\ddu v18.0.6.0\display driver uninstaller.exe
c:\windows\system32\ntdll.dll
5636C:\WINDOWS\system32\DllHost.exe /Processid:{F32D97DF-E3E5-4CB9-9E3E-0EB5B4E49801}C:\Windows\System32\dllhost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
COM Surrogate
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\dllhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\msvcrt.dll
5876"C:\Users\admin\AppData\Local\Temp\DDU v18.0.6.0\Display Driver Uninstaller.exe" C:\Users\admin\AppData\Local\Temp\DDU v18.0.6.0\Display Driver Uninstaller.exe
explorer.exe
User:
admin
Company:
Wagnardsoft
Integrity Level:
HIGH
Description:
Display_Driver_Uninstaller
Exit code:
0
Version:
18.0.6.0
Modules
Images
c:\users\admin\appdata\local\temp\ddu v18.0.6.0\display driver uninstaller.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
6300"C:\WINDOWS\system32\NOTEPAD.EXE" C:\Users\admin\AppData\Local\Temp\DDU v18.0.6.0\Readme.txtC:\Windows\System32\notepad.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Notepad
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\notepad.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\user32.dll
6300 -CleanComplete -RestartC:\Users\admin\AppData\Local\Temp\DDU v18.0.6.0\Display Driver Uninstaller.exe—Display Driver Uninstaller.exe
User:
admin
Company:
Wagnardsoft
Integrity Level:
HIGH
Description:
Display_Driver_Uninstaller
Exit code:
0
Version:
18.0.6.0
Modules
Images
c:\users\admin\appdata\local\temp\ddu v18.0.6.0\display driver uninstaller.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
6380"C:\Users\admin\AppData\Local\Temp\DDU v18.0.6.0.exe" C:\Users\admin\AppData\Local\Temp\DDU v18.0.6.0.exe
explorer.exe
User:
admin
Company:
Igor Pavlov
Integrity Level:
MEDIUM
Description:
7z SFX
Exit code:
0
Version:
19.00
Modules
Images
c:\users\admin\appdata\local\temp\ddu v18.0.6.0.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\oleaut32.dll
Total events
12 622
Read events
12 111
Write events
242
Delete events
269

Modification events

(PID) Process:(5876) Display Driver Uninstaller.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Display Driver Uninstaller_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(5876) Display Driver Uninstaller.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Display Driver Uninstaller_RASAPI32
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(5876) Display Driver Uninstaller.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Display Driver Uninstaller_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(5876) Display Driver Uninstaller.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Display Driver Uninstaller_RASAPI32
Operation:writeName:FileTracingMask
Value:
(PID) Process:(5876) Display Driver Uninstaller.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Display Driver Uninstaller_RASAPI32
Operation:writeName:ConsoleTracingMask
Value:
(PID) Process:(5876) Display Driver Uninstaller.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Display Driver Uninstaller_RASAPI32
Operation:writeName:MaxFileSize
Value:
1048576
(PID) Process:(5876) Display Driver Uninstaller.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Display Driver Uninstaller_RASAPI32
Operation:writeName:FileDirectory
Value:
%windir%\tracing
(PID) Process:(5876) Display Driver Uninstaller.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Display Driver Uninstaller_RASMANCS
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(5876) Display Driver Uninstaller.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Display Driver Uninstaller_RASMANCS
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(5876) Display Driver Uninstaller.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Display Driver Uninstaller_RASMANCS
Operation:writeName:EnableConsoleTracing
Value:
0
Executable files
2
Suspicious files
9
Text files
142
Unknown types
25

Dropped files

PID
Process
Filename
Type
6380DDU v18.0.6.0.exeC:\Users\admin\AppData\Local\Temp\DDU v18.0.6.0\Readme.txttext
MD5:B799724D8655DE1ED86C7E45AC96C33B
SHA256:8F1885B7603D1E2CB6D231774B83C6AD622A7B7CF87DE835A68951084833A517
6380DDU v18.0.6.0.exeC:\Users\admin\AppData\Local\Temp\DDU v18.0.6.0\Settings\AMD\driverfilesKMAFD.cfgtext
MD5:D70453F20B7BF4A2AF60B7B5F79913C3
SHA256:361DC0F70D29B09CA5C245C7F4631AA6146D646DF973A4C9E88E84D2CFB61898
6380DDU v18.0.6.0.exeC:\Users\admin\AppData\Local\Temp\DDU v18.0.6.0\Settings\AMD\classroot.cfgtext
MD5:7F92472092A396A1172E3D3CD081E944
SHA256:2192B61A950AE88041B6B40E754D74F7E41348B9264C9777EB401BB001F983E5
6380DDU v18.0.6.0.exeC:\Users\admin\AppData\Local\Temp\DDU v18.0.6.0\Settings\AMD\driverfiles.cfgtext
MD5:1C1CDEC6FD5A350B837EED0385394084
SHA256:195068137C0966E2E4F9277D222483575E05946A01F3CD5367573885A2C7199D
6380DDU v18.0.6.0.exeC:\Users\admin\AppData\Local\Temp\DDU v18.0.6.0\Issues and solutions.txttext
MD5:4D29CE16237FEC3A3BACE44EDA19AB56
SHA256:CC03A870A2669DDCF43184B877B1795ED34963CFFEC2A13280483F3FD688D498
6380DDU v18.0.6.0.exeC:\Users\admin\AppData\Local\Temp\DDU v18.0.6.0\Licence.txttext
MD5:68FE02ED8BBBE343151236896D037CB6
SHA256:F0BA074B93FAD29B17F2D0231F9C5152C0DFA418C5F0C37B0324C72B0E8A5728
6380DDU v18.0.6.0.exeC:\Users\admin\AppData\Local\Temp\DDU v18.0.6.0\Display Driver Uninstaller.pdbbinary
MD5:3A0137C74F58A9CACD1EED45CFE241FE
SHA256:C1E6674ECB7CBD626634FFDFDEBC0B3B6EEE8BA320AAF7B32328F04590FB984E
6380DDU v18.0.6.0.exeC:\Users\admin\AppData\Local\Temp\DDU v18.0.6.0\Settings\INTEL\interface.cfgtext
MD5:F37B89FA3B54BF60D0B5AD875A6650D8
SHA256:EB5441EC9448FDF0D0268B6B0FDB17467F1F51A06562F8935039C926EC56FDB7
6380DDU v18.0.6.0.exeC:\Users\admin\AppData\Local\Temp\DDU v18.0.6.0\Settings\INTEL\driverfiles.cfgtext
MD5:D98C765DE58D56EA14ED6A25380718AE
SHA256:D0C45D24B2B3BC05F428C9E91D832A8566E28C03277521CB0EFB4F49A667767C
6380DDU v18.0.6.0.exeC:\Users\admin\AppData\Local\Temp\DDU v18.0.6.0\Settings\AMD\packages.cfgtext
MD5:E0323AF9EDEECA54100C97CD1E165570
SHA256:3B585F3B654FA8751A5C9512358AECB3FA8B41DC2B3DBEA6807E2522C6F1D018
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
13
TCP/UDP connections
82
DNS requests
33
Threats
1

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3396
MoUsoCoreWorker.exe
GET
200
2.16.241.12:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5876
Display Driver Uninstaller.exe
GET
301
188.114.97.3:80
http://www.wagnardsoft.com/DDU/currentversion2.txt
unknown
—
—
whitelisted
—
—
GET
200
88.221.169.152:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
—
—
GET
200
2.16.241.12:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
3396
MoUsoCoreWorker.exe
GET
200
88.221.169.152:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
4656
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
4636
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
3808
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
—
—
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
2832
SIHClient.exe
GET
200
88.221.169.152:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1832
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4656
SearchApp.exe
2.23.209.169:443
—
Akamai International B.V.
GB
unknown
—
—
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
2.23.209.169:443
—
Akamai International B.V.
GB
unknown
—
—
2.16.241.12:80
crl.microsoft.com
Akamai International B.V.
DE
unknown
3396
MoUsoCoreWorker.exe
2.16.241.12:80
crl.microsoft.com
Akamai International B.V.
DE
unknown
—
—
88.221.169.152:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
3396
MoUsoCoreWorker.exe
88.221.169.152:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
4032
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.124.78.146
  • 40.127.240.158
  • 51.104.136.2
whitelisted
crl.microsoft.com
  • 2.16.241.12
  • 2.16.241.19
whitelisted
www.microsoft.com
  • 88.221.169.152
whitelisted
google.com
  • 142.250.185.206
whitelisted
login.live.com
  • 40.126.31.69
  • 20.190.159.71
  • 40.126.31.73
  • 20.190.159.64
  • 40.126.31.67
  • 40.126.31.71
  • 20.190.159.75
  • 20.190.159.68
  • 40.126.32.68
  • 40.126.32.134
  • 40.126.32.72
  • 20.190.160.22
  • 40.126.32.136
  • 20.190.160.14
  • 40.126.32.138
  • 40.126.32.140
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
go.microsoft.com
  • 184.28.89.167
  • 23.35.238.131
whitelisted
nexusrules.officeapps.live.com
  • 52.111.229.48
whitelisted
arc.msn.com
  • 20.223.35.26
whitelisted
www.bing.com
  • 2.23.209.188
  • 2.23.209.191
  • 2.23.209.192
  • 2.23.209.186
  • 2.23.209.176
  • 2.23.209.180
  • 2.23.209.130
  • 2.23.209.187
  • 2.23.209.133
  • 2.23.209.139
  • 2.23.209.135
  • 2.23.209.136
  • 2.23.209.185
  • 2.23.209.189
whitelisted

Threats

Found threats are available for the paid subscriptions
1 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
DDU v18.0.6.0.exe